4 ms·

Not a pi-hole user, but what is the plan for pi-hole once encrypted dns is everywhere? Will it just be dead? I can’t really think of a way for it not to be.

blacksmith_tb 6y ago
Couldn't you host pi-hole on a cheap VM and set it to be your DNS-over-TLS / DNS-over-HTTPS endpoint?
- Skunkleton 6y ago
  This assumes that your software is doing what you asked it to do, not what some bigco or malware wanted it to do.
  - silon42 6y ago
    firewall anything that doesn't go through your DNS server... at least thay way the malware will be obviously detectable.
    - Spivak 6y ago
      But DoH is just any other HTTP request. This is the downside of networks blocking everything except 80/443 outbound and browsers not supporting SRV records.
  - goatinaboat 6y ago
    If I remember correctly Chrome already ignores your DNS and does it’s own over HTTPS.
    - Xylakant 6y ago
      I think you're misremembering. This is the most official documentation of the rollout plan for DoH that I can quickly ddg: https://www.chromium.org/developers/dns-over-https https://www.chromium.org/developers/dns-over-https - in a gist: If the systems resolver is known to support DoH, the DNS query will get upgraded to DoH. That means chrome will still be using the configured systems resolver, but the connection will be encrypted. I think you're remembering what firefox is rolling out: Firefox will by default, if DoH is enabled for your country by default use a specific provider that subjects to additional privacy controls. However, firefox respects network level settings (for example a specific canary domain that should resolve) and will disable DoH, even if the default is enabled - unless again, the user has overwritten that in a setting. That means that the network owner is still in full control of the network-wide default and PiHole supports this approach. So a stock firefox in a network that uses pi-hole will not use DoH.
      - goatinaboat 6y ago
        Thanks for clarifying that!
0xCMP 6y ago
You can always reconfigure your DNS. It's important feature so unlikely they'll get rid of that.
Skunkleton 6y ago
DoT isn't a big problem for a pihole, but it doesn't look like things are going that way. DoH can only be blocked by a mitm proxy. You would have to take a pretty serious security hit to do something like that with a pihole.
- OJFord 6y ago
  Wouldn't pi-hole be the 'resolver' the other end of the request, the party it's encrypted for? Sure, Apple (or whoever) could just bypass it and use something specific, but can already just use an IP, no DNS anyway?
  - Macha 6y ago
    My understanding is the concern would be that closed source applications would use a hardcoded DoH resolver and pinned certs to bypass any unwanted blocks of ads/telemetry which could only be resolved with decompilation and patching with varying degrees of difficulty.
    - gsnedders 6y ago
      Is this much more of a concern than closed source applications that use open DNS but use pinned certs to connect to the resolved host?
    - ardy42 6y ago
      > My understanding is the concern would be that closed source applications would use a hardcoded DoH resolver and pinned certs to bypass any unwanted blocks of ads/telemetry which could only be resolved with decompilation and patching with varying degrees of difficulty. IIRC, the vision with DoH is that eventually even browsers would do DNS as part of a bunch of pipelined HTTP requests. So you call up https://www.example.com/page.html https://www.example.com/page.html and www.example.com resolves img.example.com for you since it's used on the page. The downside is www.example.com could also resolve tracker.adnetwork.com for you, too. IIRC, DoH is there to defeat MITM attacks, but stuff like Pi-Hole is basically a MITM attack, so it's kinda collateral damage. I bet network-level ad-blocking will eventually have to evolve into literal firewall rules on the gateway.
dwrodri 6y ago
The pi-hole software turns the Raspberry Pi into a DNS server, so you can point your own DNS server (i.e. the raspberry pi) at the DNS provider of your choosing so that it can resolve uncached queries. I don't think encryption matters because you control the sender (your PC), the first hop (the pi-hole), and the next resolution destination (Cloudflare/Quad9/Google/OpenDNS/etc.).
- novok 6y ago
  He is referring to the fact that apps will start ignoring local network DNS config and directly talk to their own hard coded DNS IPs. I'm guessing the solution to that is to firewall various DNS IPs to force the app to use your local DNS. I could forsee apps going to random IPs for DNS and making it look like https, which will be hard to deal with.
  - toast0 6y ago
    > I could forsee apps going to random IPs for DNS and making it look like https, which will be hard to deal with. DoH isn't really going to look like https, the requests and responses are going to be too small. If you're serious about it, you don't allow any random IP connections, only allow connections to IPs that were received by DNS, and only return proxy addresses that you NAT to the real thing. It's more work, but it's still trivial.
    - ignoramous 6y ago
      > ...only allow connections to IPs that were received by DNS Works for a home / office setup. I think the main use of DoH is circumventing government enforced censorships, to an extent that it can. For ISPs to use "packet sizes" they'd need to run stateful firewalls at scale, which is unheard of, and possibly very expensive to run at that scale.
skykooler 6y ago
You could have it spoof the keys and add its keys to your OS's key store.
- layoutIfNeeded 6y ago
  >add its keys to your OS's key store What key store? User-hostile apps (like Chrome) already use their own key store because they know better than the user :^)
Spivak 6y ago
You use your pi-hole as your encrypted DNS provider?
- buzzerbetrayed 6y ago
  > Not a pi-hole user
rsync 6y ago
Here is what I did ... First, I created my own recursive resolver in the cloud using 'unbound'. You can do this quickly and easily with an EC2 instance or whatever (mine is a FreeBSD jail on my own server). Second, I got a paid nextdns.io account and enabled the basic blocklists which are, essentially, the same as ublock origin would have locally. Third, I set my recursive resolver to use the nextdns.io endpoint as its upstream source of DNS. Finally, I set all of my networks to assign my personal DNS server (and no others) for all DHCP requests and I hardcoded it into my own machines. So now I control my own dns, globally, and my upstream source of name resolution is "sanitized". Theoretically, I could just remove ublock origin from my browsers now ... Then I
- ignoramous 6y ago
  > Third, I set my recursive resolver to use the nextdns.io endpoint as its upstream source of DNS. Doesn't that relegate your recursive resolver to a stub? You could run pi-hole on fly.io for free if DoT/DoH is all you need: https://fly.io/blog/stuff-your-pi-hole-from-anywhere/ https://fly.io/blog/stuff-your-pi-hole-from-anywhere/ I run a public DoH resolver with 170+ blocklists on Cloudflare Workers. Might open source it soon.
  - dhaavi 6y ago
    Nice. Do you have any more info on that resolver of yours?
    - deleted 6y ago
      [deleted]
    - deleted 6y ago
      [deleted]

blacksmith_tb 6y ago

Couldn't you host pi-hole on a cheap VM and set it to be your DNS-over-TLS / DNS-over-HTTPS endpoint?

Skunkleton 6y ago
This assumes that your software is doing what you asked it to do, not what some bigco or malware wanted it to do.
- silon42 6y ago
  firewall anything that doesn't go through your DNS server... at least thay way the malware will be obviously detectable.
  - Spivak 6y ago
    But DoH is just any other HTTP request. This is the downside of networks blocking everything except 80/443 outbound and browsers not supporting SRV records.
- goatinaboat 6y ago
  If I remember correctly Chrome already ignores your DNS and does it’s own over HTTPS.
  - Xylakant 6y ago
    I think you're misremembering. This is the most official documentation of the rollout plan for DoH that I can quickly ddg: https://www.chromium.org/developers/dns-over-https https://www.chromium.org/developers/dns-over-https - in a gist: If the systems resolver is known to support DoH, the DNS query will get upgraded to DoH. That means chrome will still be using the configured systems resolver, but the connection will be encrypted. I think you're remembering what firefox is rolling out: Firefox will by default, if DoH is enabled for your country by default use a specific provider that subjects to additional privacy controls. However, firefox respects network level settings (for example a specific canary domain that should resolve) and will disable DoH, even if the default is enabled - unless again, the user has overwritten that in a setting. That means that the network owner is still in full control of the network-wide default and PiHole supports this approach. So a stock firefox in a network that uses pi-hole will not use DoH.
    - goatinaboat 6y ago
      Thanks for clarifying that!

0xCMP 6y ago

You can always reconfigure your DNS. It's important feature so unlikely they'll get rid of that.

Skunkleton 6y ago

DoT isn't a big problem for a pihole, but it doesn't look like things are going that way. DoH can only be blocked by a mitm proxy. You would have to take a pretty serious security hit to do something like that with a pihole.

OJFord 6y ago
Wouldn't pi-hole be the 'resolver' the other end of the request, the party it's encrypted for? Sure, Apple (or whoever) could just bypass it and use something specific, but can already just use an IP, no DNS anyway?
- Macha 6y ago
  My understanding is the concern would be that closed source applications would use a hardcoded DoH resolver and pinned certs to bypass any unwanted blocks of ads/telemetry which could only be resolved with decompilation and patching with varying degrees of difficulty.
  - gsnedders 6y ago
    Is this much more of a concern than closed source applications that use open DNS but use pinned certs to connect to the resolved host?
  - ardy42 6y ago
    > My understanding is the concern would be that closed source applications would use a hardcoded DoH resolver and pinned certs to bypass any unwanted blocks of ads/telemetry which could only be resolved with decompilation and patching with varying degrees of difficulty. IIRC, the vision with DoH is that eventually even browsers would do DNS as part of a bunch of pipelined HTTP requests. So you call up https://www.example.com/page.html https://www.example.com/page.html and www.example.com resolves img.example.com for you since it's used on the page. The downside is www.example.com could also resolve tracker.adnetwork.com for you, too. IIRC, DoH is there to defeat MITM attacks, but stuff like Pi-Hole is basically a MITM attack, so it's kinda collateral damage. I bet network-level ad-blocking will eventually have to evolve into literal firewall rules on the gateway.

dwrodri 6y ago

The pi-hole software turns the Raspberry Pi into a DNS server, so you can point your own DNS server (i.e. the raspberry pi) at the DNS provider of your choosing so that it can resolve uncached queries. I don't think encryption matters because you control the sender (your PC), the first hop (the pi-hole), and the next resolution destination (Cloudflare/Quad9/Google/OpenDNS/etc.).

novok 6y ago
He is referring to the fact that apps will start ignoring local network DNS config and directly talk to their own hard coded DNS IPs. I'm guessing the solution to that is to firewall various DNS IPs to force the app to use your local DNS. I could forsee apps going to random IPs for DNS and making it look like https, which will be hard to deal with.
- toast0 6y ago
  > I could forsee apps going to random IPs for DNS and making it look like https, which will be hard to deal with. DoH isn't really going to look like https, the requests and responses are going to be too small. If you're serious about it, you don't allow any random IP connections, only allow connections to IPs that were received by DNS, and only return proxy addresses that you NAT to the real thing. It's more work, but it's still trivial.
  - ignoramous 6y ago
    > ...only allow connections to IPs that were received by DNS Works for a home / office setup. I think the main use of DoH is circumventing government enforced censorships, to an extent that it can. For ISPs to use "packet sizes" they'd need to run stateful firewalls at scale, which is unheard of, and possibly very expensive to run at that scale.

skykooler 6y ago

You could have it spoof the keys and add its keys to your OS's key store.

layoutIfNeeded 6y ago
>add its keys to your OS's key store What key store? User-hostile apps (like Chrome) already use their own key store because they know better than the user :^)

Spivak 6y ago

You use your pi-hole as your encrypted DNS provider?

buzzerbetrayed 6y ago
> Not a pi-hole user

rsync 6y ago

Here is what I did ... First, I created my own recursive resolver in the cloud using 'unbound'. You can do this quickly and easily with an EC2 instance or whatever (mine is a FreeBSD jail on my own server). Second, I got a paid nextdns.io account and enabled the basic blocklists which are, essentially, the same as ublock origin would have locally. Third, I set my recursive resolver to use the nextdns.io endpoint as its upstream source of DNS. Finally, I set all of my networks to assign my personal DNS server (and no others) for all DHCP requests and I hardcoded it into my own machines. So now I control my own dns, globally, and my upstream source of name resolution is "sanitized". Theoretically, I could just remove ublock origin from my browsers now ... Then I

ignoramous 6y ago
> Third, I set my recursive resolver to use the nextdns.io endpoint as its upstream source of DNS. Doesn't that relegate your recursive resolver to a stub? You could run pi-hole on fly.io for free if DoT/DoH is all you need: https://fly.io/blog/stuff-your-pi-hole-from-anywhere/ https://fly.io/blog/stuff-your-pi-hole-from-anywhere/ I run a public DoH resolver with 170+ blocklists on Cloudflare Workers. Might open source it soon.
- dhaavi 6y ago
  Nice. Do you have any more info on that resolver of yours?
  - deleted 6y ago
    [deleted]
  - deleted 6y ago
    [deleted]